Controller and model concerns

This moves two concern-like things which we were already using in controllers into the default Rails 4 place for concerns, and makes them both work without having to explicitly include the module in the controller. It also moves the disabling of columns which should not be used by an STI subclass into a new model concern.

We don't use `ActiveSupport::Concern` for any of these because we need to pass options through to the callbacks, so need to call the provided methods rather than simply including the modules.

I'm not sure that attempting to disable columns is worth doing - this PR makes it work slightly more than it did before, but it is still possible to set those attributes and save them, and read them on the same instance. In addition, `ActiveModel::MissingAttributeError` is raised when trying to read from disabled attributes, whereas `NoMethodError` is raised for ones which really don't exist.

There is some value at least in having an indication on the model that those columns shouldn't be used, but it isn't enforced consistently. We shouldn't and don't rely on it, but it does look as though it's trying to completely hide them and doesn't manage to. I don't think it's worth any more effort to make it work in every case. Shall we delete it entirely or leave it as it is here?
These seem to be named after the method we're using to mix them in rather than the module name. Ordinarily we wouldn't want to do this for concerns as it would break the autoload mechanism. We're not using autoload for these, but it could mislead in future.